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Abstract 

Model-based reasoning has been applied as an autonomous 
control strategy on the Low Energy Neutral Atom (LENA) 
instrument currently flying on board the Image r for 
Magnetosphere-to-Aurora Global Exploration (IMAGE) 
spacecraft. Explicit models of instrument subsystem 
responses have been constructed and are used to dynamically 
adapt the instrument to the spacecraft's environment. These 
functions are cast as part of a virtual Principal Investigator 
(VPl) that autonomously monitors and contro s 
instrument. In the VPl’s current implementation, LENA s 
command uplink volume has been decreased significantly 
from its previous volume; typically, no uplinks are required 
for operations. This work demonstrates that a model-based 
approach can be used to enhance science instrument 
effectiveness. The components of LENA are common in 
space science instrumentation, and lessons learned y 
modeling this system may be applied to other instruments. 
Future work involves the extension of these methods to cover 
more aspects of LENA operation and the generalization to 
other space science instrumentation. 


Introduction 

Multiprobe missions are an important part of N A | A 
future Consider the missions of the Sun-Earth 
Connections (SEC) theme, which include missions such as 
Magnetospheric Multi Scale (MMS, five spacecraft launch 
2006) and the Magnetospheric ConsteUation Draco ) 50- 
spacecraft, launch 2010). Members of NASAs Solar 
Terrestrial Probe line, these missions are part of a senes ot 
technologically ambitious projects that build towards th 
placement of a distributed sensor web that can accurately 
measure the mesoscale structure and dynamics of 
Geospace. Geospace is the region of space wherein the 
Sun and Earth interact to produce Space Weather. T ° ma !“ 
such missions robust, reliable, and affordable, ideally the 
many spacecraft of a constellation must be at least as easy 

to operate as one spacecraft is today. . f 

This level of performance is to be achieved in spite of 
full suites of scientific instruments, limited communication 
opportunities perhaps separated by weeks and limited 
ground operations resources. Downlink ba "^ 

limitations reduce the coverage and resolution of the 

science products that missions may produce. Furthermo e. 
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understanding many important phenomena requires 
simultaneous measurements from multiple spacecraft. 
Operations techniques that require communication with the 
«round incur communications latencies and suffer 
bandwidth limitations that inhibit a mission's ability to 
react to science of opportunity, to coordinate collective 
behaviors across the constellation, and to deal with faults. 

The advantages of spacecraft autonomy have been 
perceived for some time, and for early missions such as 
Ranger 6 [1] and the early Mars and Venus Mariners [*-] an 
amount of autonomy was a matter of course due to ow 
communication rates and limited commandab.l.ty. 
Advances in space borne computers and communications 
technology led to spacecraft that could more readily be 
configured and commanded. Part of this trend has 
continued as computer technology has presented 
opportunities first to automate, and then to add flexibility 
and fault tolerance to different segments of the mission 13J. 
Increasing numbers of increasingly complex spacecraft 
have led to the recent study and application of even more 
sophisticated approaches. 

One recent approach that is relevant to science missions 
is the Remote Agent Executive (RAX) experiment that 
operated Deep Space One with some success during an 
asteroid flyby [4]. One module of RAX maintains a set of 
models that correspond to spacecraft systems and makes 
plans and resolves conflicts by reasoning based on these 
models [5], A key driver of RAX resource requirements is 
the complexity of constructing mission plans that maintain 
system constraints. One way to reduce this complexity is 
to delegate responsibility for operation to spacecraft 
subsystems, leading to the concept of subsystem or 

instrument-based autonomy [6]. 

To reduce the complexity of the problem we feel it best 
to aggressively attack and reduce system complexity at 
each level of a system’s hierarchy. Reducing system 
complexity at the lowest levels may dramatically reduce the 
complexity of the overlying control functions. This eases 
the burden of spacecraft level autonomy, e.g. at the level ot 
a spacecraft agent like RAX. By moving instrument 
operations as far to the instrument as possible, including the 
autonomous production of data products, communication 
resource requirements can be dramatically reduced while at 
the same time dramatically improving the quality and 

quantity of the science obtained [7]. 

We have tested these ideas in the context of the Low 
Energy Neutral Atoms (LENA) experiment that is flying on 
the Imager for Magnetosphere-to-Aurora Global 
Exploration (IMAGE) observatory [8], IMAGE is a 
NASA/SEC mission designed to obtain a global picture ot 
the Earth’s magnetosphere using a variety of remote 
sensing techniques. LENA, being a particle detector, can 
be impaired or may fail because of excessive particle fluxes 
or environmental radiation [9], We have constructed an 
explicit model of LENA’S response. The instrument uses 
this model to dynamically adapt its response to 
autonomously maintain instrument health and safety and 
improve science return. We call the reasoning system that 
uses the model to determine how to configure LENA the 


Virtual Principal-Investigator (VP1) because of the 
responsibility it holds for instrument operations. By 
implementing these functions at the instrument level it was 
possible to bring these advanced behaviors '^o the very 
constrained computing environment of the LENA Flight 
Model. Furthermore, these enhancements were realized 
with no deleterious impact on other IMAGE systems. 

In this paper we are focusing on a proposed approach to 
achieve autonomy for scientific instruments. We begin by 
considering some autonomy options and by presenting an 
overview of the model-based approach to autonomous 
instrument operations that is currently under investigation. 
Then we discuss the application of these ideas to LENA 
followed by a discussion of challenges to generalizing our 
model-based approach to other instruments. We close with 
a discussion of future work along these lines After 
presenting our approach, we report on the deployed 
system’s performance and the lessons we have learned 

during the work. 

Model-based Autonomous Instrument 
Operations 

The focus of this paper is on future autonomy for spacecraft 
instrument operations. A current study, reported on in this 
paper, focuses on a model-based reasoning approach to 
instrument autonomy and its application to the autonomy o 
the LENA instrument on the IMAGE spacecraft. 

Figure l depicts the major concepts associated with this 
study. The basic idea is quite straightforward. The ground- 
based Principal Investigator (PI - we use PI both in a 
singular and collective sense) has a mental model on the 
instrument and its designed behaviors, inputs, outputs. 
This model is formalized and codified and becomes the 
model that an onboard intelligent process uses to guide the 
operations of the instrument and to aid in diagnosing 
instrument faults and taking corrective actions. From our 
perspective and in our LENA-related work a model is some 
representation of reality that is used to support an 
understanding of that reality and to make decisions about 
the behaviors associated with that reality. As Kaposi and 
Meyers [10] put it: “A good model is not an arbitrary 
representation, but a systematic, purposeful simplification 
of its referent. Such a model focuses attention on selected 
attributes which hold the key to the solution of the given 
problem and suppresses features which, for the given 
situation, are less crucial or irrelevant.’’ 

There are several ways to deal with models. Three major 
classifications of use are: 

• Internal representation (model embedded in code 
as a procedure). In this case the model is implicit. 


• External representation (model expressed in an 
external knowledge representation processed by 
some procedural code). In this case the model is 



explicit and thus easily modified or adapted to a 
changing environment. 


flight/position sensing section (6) where ion mass, energy, 
and angle are determined [11]. 


• Hybrid representation (a combination of the two). 


In this phase of the LENA modeling work, use has been 
very successfully made of the internal representation 
approach resulting in on-board software automating various 
LENA functions. The intent is to graduate to the external 
representation approach. The following section will 
discuss what we have achieved so far in applying this 
autonomy concept to LENA. 

Model-Based Reasoning Applied to 
IMAGE/LENA 

IMAGE/LENA Objectives 

The IMAGE observatory is a spin-stabilized spacecraft that 
was launched in March 2000 into an elliptical polar orbit 
with an apogee altitude of 7.2 earth radii (45,922 km) and a 
perigee altitude of 1000 km. It is the first satellite 
dedicated to imaging earth’s magnetosphere. LENA, one 
among the suite of 6 instruments on the payload uses high- 
voltage electrostatic optics and time-of-flight mass 
spectroscopy to image fast neutral atom flux and measure 
its composition and energy distribution. 


LENA Implementation 

Simulated particle trajectories are plotted in Figure 2. 
Neutral particles (1) enter the instrument through a 
collimator (2) which filters charged particles. The tungsten 
surface (3) converts neutrals to negative. Negative ions 
from the surface are then collected by the extraction lens 
(4), which focuses all negative ions with the same energy to 
a fixed location. The ions are then accelerated by a high 
voltage optics potential prior to entering the electrostatic 
analyzer (5). Finally, the ions pass into a time-of- 



The electrostatic potentials required to conduct the 
Lperiment are derived from 5 commandable high-voltage 
jwer supplies: 2 collimator supplies, an ion optics supply 
,d 2 microchannel plate (MCP) supplies. These supplies 
id the TOF subsystem are controlled by an 8-bit 
351 microcontroller-based command and data handling 

The 805 1 executes all data processing Throughput is less 
ian 1 million instructions per second (MIP). Code space is 
2 kbytes and data space is 64 kbytes. These constraints 
irongly influence the autonomy strategies and realizations 
riplemented onboard. 

IMAGE is operated as a lights-out mission t 
pacecraft is out of ground contact except for once during 
ach 14.2-hour orbit. To support this operations paradigm, 
he IMAGE central instrument data processor permits 
iueued commands to be routed to LENA at predetermine 
imes. This allows the instrument to be configured in 
esponse to predictable conditions. It is important. 




however, that LENA also have the capability to react 
immediately to conditions that could threaten the health and 
safety of instrument systems — autonomous real-time 
command capability. 

Autonomous Operations Virtual Principal 
Investigator (VPI) 

The ground-based Pi’s ability configure the instrument in 
response to dynamic conditions is hindered by limited 
observability of LENA parameters. The downlink 
bandwidth allocated to LENA renders it unfeasible to 
telemeter parameters at a sample-rate high enough to 
ensure that transient behavior will be captured. 
Communications latency further constrains real-time 
responses. We address these issues by conveying a subset 
of LENA’S command authority from the ground to a 
Virtual Principal Investigator (VPI) onboard the instrument 
(Figure 3). 

The VPI provides the capability to respond in real-time 
to predicted (e.g. radiation belt) and random (e.g. solar 
storms) conditions. Actions that can be initiated onboard 
are consistent with the command authority granted by the 
ground-based PI (Table 2). 

The VPI is primarily tasked with monitoring and 
controlling three critical LENA behaviors: instrument over- 
stimulation, high-voltage health and safety and radiation- 
belt induced collimator effects. Potentially damaging event 
rates could result from high-flux environments. They could 
also be indicative of high-voltage discharges that could 
degrade electrostatic surfaces and damage electronic 
components. In either case, the start or stop channel gains 
must be reduced to limit the resultant count rates. 
Operation of the high-voltage systems is also monitored. 
The status of each high-voltage supply is thereby derived. 
The state of the electrostatic surfaces can also be indirectly 
inferred since excessive currents or unregulated voltages 
may be indicative of anomalous conditions on these 
surfaces. Control of these behaviors is granted authority 
level I. 


Table 2 - Onboard Authority Level 

Authority 

Level 

Granted 

Reasoning 

Locale 

Possible Onboard Actions 

I 

onboard 

Initiate commands 
Inform ground of actions 
taken 

II 

Onboard/ 

ground 

Submit recommended 
actions to ground 

III 

ground 

none 


The VPI operates within a model-based framework. The 
behavior of the instrument is decomposed into a family of 
behavioral models with each model mapped to a 
subsystem. A model captures the electrical response 
function of the targeted system. The models are typically 
excited with the same stimuli as the systems they represent. 
The resultant responses are routed to the VPI, which 
considers whether the current instrument state is desirable, 
and if not, initiates corrective actions. 

High Voltage Power Subsystem (HVPS). The HVPS 
models incorporate components of varying complexity. 
The degree of complexity is consistent with information the 
VPI requires to ascertain and control the state of system. A 
first-order polynomial appropriately codifies the voltage 
response of the HVPS to commands. Power supply 
currents, however, are not accurately predicted over the 
operations range of the power supplies because of 
disturbance effects and component variations that are not 
modeled in LENA’S present implementation. Therefore the 
VPI uses simple current threshold tests to verify this aspect 
of HVPS operation. The model for each supply is 
appropriately represented as a constant range (Figure 4). 




- considerable latency 

- bandwidth limited 

- limited observability 
potentially expensive 


> delayed 
reactions 
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Figure 3 - Ground Based vs. Onboard Control 





Figure 4 - Virtual-PI HVPS Control 

The VPI uses the model outputs to maintain or correct 
the state of LENA. Measured and modeled parameters are 
updated and reaction commands are executed on a time- 
scale consistent with the dynamics of the targeted system 
and the control objectives of the VPI. For example, HVPS 
reasoning is implemented as follows: compare the voltage 
response of the power supply with the expected response. 

If the deviation exceeds P| volts for longer than P2 seconds, 
take P 3 action. Here, P n are parameters that can be varied 
under ground control. Furthermore, compare measured 
currents and voltages to the threshold levels P 4 - If a 
threshold is exceeded for longer than P5 seconds, take 
action P 6 , where again P n are ground commandable 
parameters. 

Time of Flight (TOF) Subsystem. Overstimulation of the 
start or stop MCP channels can compromise the TOF 
system. Excessive rates could result from the periodic 
radiation passes or from energetic solar ions. 

The effective gains of the TOF channels are proportional 
to the MCP-start and MCP-stop potentials. While science 
return is maximized when these voltages are at their 
nominal levels, high count rates are also likely to occur. 
The goal of the VPI is therefore to maximize nominal-level 
operations, but reduce voltages as required to maintain 
instrument health and safety. 

Time-tagged commands could be used to decrease the 
gains during the periodic radiation passes. The drawback 
of this approach, however, is that count rates cannot be 
predicted as a function of time with great accuracy. 
Therefore, fairly conservative time boundaries are typically 
used to define when instruments should safe themselves. 
This approach compromises science return. 

A more robust approach is to react directly to count rates. 
Gains are reduced only when required. This approach has 
the advantage of not only reacting to events that result from 
the periodic radiation encounters, but to unpredictable 
energetic particle events as well. 

After the VPI has configured the instrument to protect 
itself in response to a high-rate scenario, it must determine 
when normal operations can resume. Since the operational 
voltages have been reduced, measured count rates cannot 


be used directly in this determination. Instead, a model ot 
each channel is used to predict when the voltages can be 
increased to nominal levels without violating an 

overstimulation criterion 

An occurrence when the flight system was 

overstimulated is shown in Figure 5 . 
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Figure 5 - Stop MCP Channel Overstimulation Response 

The stop singles response shown in the upper plot is a 
function of the incoming particle flux and the 
corresponding stop MCP voltage shown in the lower plot. 
The VPI detected instrument overstimulation and 
subsequently reduced the voltage from the nominal 
operating point as shown in the lower plot. 

An MCP gain model is used to predict when the nominal 
operating voltage can be restored (Figure 6). 



Figure 6 — MCP Gain Model M(x,v) 


The model, codified as a 2-dimensional lookup table is 
parameterized with respect to MCP HVPS voltage and a 
signal detection threshold x used in the TOF electronics. 
The model acts upon the measured tlux to predict the count 





rate R that would be measured at the nominal operating 
voltage v nu ,„, 

R (predicted) = k • flux measured • M(t,V no m)> 

where k incorporates various scale factors resulting from 
the electronics signal processing path. The VPl restores 
nominal operations when the predicted rate does not exceed 
the overstimulation criteria. 


Lessons Learned- Development Through 
Current Operations 

LENA has not only enabled discovery in the area of neutral 
atom imaging. It has also shed considerable insight into 
methods of controlling a space-flight instrument 
autonomously. Following are some of the lessons we have 
learned. 


Collimator Radiation Effects Mitigation. IMAGE’S 
elliptical trajectory transverses the inner radiation belt each 
orbit. The high-energy particles captive in this region can 
compromise the long-term performance of the collimator 
system if the system is active during these passes. Time- 
tagged commands could be used to disable it before entry 
to these regions and re-enable it after exit. Rather 
conservative tags would have to be used however, since the 
times of passage through the belt are not predicted with 
great accuracy. The collimator would be disabled longer 
than necessary, resulting in compromised science return 
since the instrument is nominally configured with the 
collimator system enabled. 

A better approach is to identify and react to the TO 
response induced by this region of space. Particles 
typically enter LENA via its aperture whereas particles in 
the radiation belt have energy sufficient to penetrate 
LENA’S chassis. These high-energy particles generate a 
TOF response that is largely isotropic. A typical Start 
MCP event response and a radiation- induced response are 
both plotted as a function of LENA spin sector in Figure 7. 



Figure 7 - Start MCP Responses 

The VPI compares the TOF response with a radiation 
response each orbit. If this signature is identified, the VPI 
concludes LENA is within the inner belt, and disables the 
collimator. It is re-enabled when the signature is no longer 
detected. 


The VPI Should Evolve. The VPI should not only evaluate 
the performance of the instrument, but should also evaluate 
its own performance in controlling the instrument . 
Although this evaluation could be performed on the 
ground, an onboard implementation may increase VPI 
effectiveness. 

If the magnitude of residuals between modeled and 
observed behavior exceed commandable thresholds, the 
VPI initiates control actions. The default thresholds were 
based on ground-based tests and early post-launch 
observations. They were selected to be sensitive enough to 
detect and react to potential problems but conservative 
enough to minimize occurrences of false alarms. 

Based on long-term analysis of ground data, we 
determined that some thresholds could be set more 
aggressively, thereby increasing VPI sensitivity to potential 
problems without significantly increasing the probability of 
false alarms. The statistics required to determine these 
levels were computed onboard. This reduced the impact o 
this enhancement on ground-support systems. But more 
importantly, it facilitated VPI learning by providing a 
means for directly routing measured performance metrics 
to the VPI. 

Change will happen. Therefore ensure that the 
autonomous strategies are extensible. The autonomous 
framework, from both systems and implementation 
perspectives, should not hinder evolution of science 
requirements. 

Autonomous control strategies are usually designed and 
implemented before launch. Their design is often based on 
incomplete information, given the limitations of ground- 
based tests relative to the actual flight environment. 
Furthermore, system requirements may evolve based 
science observations. Nonetheless, once on orbit, the VPI 
must meet the ground Pi’s prelaunch science objectives and 
be readily adaptable to evolving post-launch requirements. 
The control strategy and the implementation architecture, 
both software and hardware, must be adaptable to 

unforeseen scenarios. . . 

Initially we underestimated the effect of the radiation 
belts on LENA stimulation. Our initial strategy was to 
count rates and disable the appropriate MCP power supply 
if a count rate threshold was exceeded. After deployment, 
a reasonable threshold was routinely exceeded during each 
radiation belt encounter. As a result, the power supplies 
were disabled on a regular basis; this was not our intended 
strategy. 



Our revised strategy decreased the radiation-induced 
count rate by reducing the MCP gains at the onset ot 
overstimulation. We used predictive techniques to restore 
nominal gains as soon as threat of overstimulation has 
passed, thereby maximizing science return. The 
extensibility of the autonomous control strategy and flight 
software reduced the implementation risk, cost and 
difficulty. 

Optimize globally. Optimal subsystem performance may 
result in subopt imal system performance. All processes, 
both ground and space-based should be considered when 
designing autonomous control strategies for the onboard 
instrument subsystems. 

The critical objective of the LENA experiment is to 
increase scientific knowledge by analyzing the data 
gathered by the instrument. Therefore, data analysis 
methods used by the science community should influence 
the design of the autonomous control strategies. 

The amplitude of the neutral atom flux sensed by LENA 
is a direct function of instrument efficiency. An efficiency 
value is typically mapped to each LENA state. Therefore, 
control strategies that reduce the number of attainable 
instrument states simplify the flux computations. 
Conversely, the instrument operating precision generally 
scales with the number of subsystems states. Therefore, a 
global optimization approach should be used to address 
these and other potential conflicting issues. 

The LENA MCP HVPS control demonstrates this issue. 
This power supply can be set with 9.4 volt resolution. 
Although control accuracy is required for good science 
return, high control resolution increases the number ot 
supply states and typically yields little additional science 
benefit. Therefore, the VP1 does not use the full power 
supply resolution; the default minimum control step is 75 
volts. Although the VPI may not control this subsystem in 
an optimal manner, e.g., the supply potential may be 
decreased more than necessary in response to an overcount 
condition, the resultant state-space simplification yields 
considerable data analysis benefits. 

System Autonomy Can be Realized Incrementally. 

Given the inherent risks in automating control of a 
spacecraft instrument, there is good reason to follow a 
cautious, incremental approach. Through software 
extensibility, good PI -developer communication, and 
steady confidence building, a system requiring essentially 
no external commands was built on-orbit. 

LENA instrument autonomy was developed under a 
policy in which instrument capability was incrementally 
enhanced. As with most spacecraft software, incremental 
enhancements were a planned part of LENA operation 
strategy. These enhancements were to adapt the LENA 
control software and operational strategy to account tor the 
actual on-orbit performance of the deployed instrument. 
The PI and instrument developers observed the behavior ot 
the deployed instrument and then determined what 
modifications were advisable to better meet mission goals. 
Thus there arose the opportunity for a well-informed 


negotiation between the stakeholders in the instrument 
development. 

The modifications to LENA software were designed to 
meet mission needs as understood by mission personnel 
after observation of LENA'S deployed performance. The 
development of these modifications was aided in great part 
by the control software’s extensibility. This extensibility 
also enabled the opportunity for enhancements to the 
software that went slightly beyond strict mission needs. 
Good communication between instrument developer and PI 
allowed the assessment of risks associated with 
enhancements to the modifications and outright 
experimentation. At every stage of development, mission 
goals were addressed by techniques for which a track 
record had been demonstrated during preceding instrument 
operations. As trusted routines were controlling the 
instrument, onboard tests were being performed on 
enhancements that formed the basis for future 
modifications. In this way, LENA went from an instrument 
that required commanding for significant behaviors to one 
that requires essentially no external commands. An 
important component of the course of this development is 
that the developer was intimately aware of the goals and 
wishes of the PI, a fact that enhanced the developer’s 
ability to negotiate the acceptance of the risk entailed by 
enhancing the autonomy of LENA. This risk was also 
ameliorated by the development of the aforementioned 
track record that allowed both the PI and developer to build 
confidence in their approach and their ability to extend the 
original control software 

A high-fidelity test environment is essential The 

software development environment must facilitate thorough 
test of incremental performance enhancements . 

The cost of failure on flight systems is high. Errant 
systems can cause measurable losses: e.g. multimillion- 
dollar spacecraft and the flight operations and data analysis 
positions that would have supported the launch. Losses 
that cannot be easily measured are significant as well: e.g., 
lost science opportunity. When new approaches are 
responsible for failure, long-term loss of confidence in 
these approaches can significantly hinder opportunities to 
implement them in future missions. Therefore a thorough 
test program is a necessity. 

Although simulators can be used to validate software, 
problems may go undetected if the fidelity of the simulator 
is not high. Therefore the LENA team uses a copy of the 
LENA flight hardware for final validation of all software 
revisions. ^ Although this approach may be more expensive 
in the short term, the long-term benefits are substantial. 


Full Autonomy Issues in a Space 
Instrumentation Context 

Four dimensions along which the path towards near-full 
autonomy that can be pursued are. 


• automation of additional planning, scheduling, and 
control functions 

• explicit model representation 

• self-modifying behavior 

• generality 

Control of the power subsystem to ensure health and 
safety is the primary concern ot LENA autonomy. For 
other instruments, planning and scheduling functions are 
essential for realizing science goals — for example, 
instruments that are positioned by command rather than by 
pre-determined pattern. Autonomous planning and 
scheduling would not only offload addition burden from 
personnel; it would also enable instruments to take rapid 
advantage of unforeseen opportunities. Clearly such 
functions would interact with health and safety controls. 

Evolving the software towards a more explicit 
representation of the instrument is a many-sided issue. In 
general, the more explicit the model, the easier it is to 
evaluate the software’s correctness and to modify it as 
needed. However, there are tradeoffs involving processing 
time and memory. Interpreting a declarative model in real- 
time usually exacts a performance price. This can be 
significant when processor cycles are limited. An 
alternative is to "‘compile” the model it into code in 
advance, but there are still binding-time choices to be 
made. For example, compilation can occur during 
development. In that case, the explicit representation serves 
as a tool for developers of the instrument software. The 
benefit can be extended to operations personnel by 
postponing compilation to software load time. This would 
not only aid in interpreting engineering data received from 
the instrument, but also in human-initiated modification of 
the model. However, instrument self-tuning and learning 
then become problematic since the model must be kept 
consistent with the operating software. These tradeoffs are 
highly dependent on the resources allotted to the 
instrument, both on-board (time, space, weight, and power 
consumption) and on the ground (time, cost, and 
complexity of development and operational tasks). 

Self-modifying behavior (e.g., machine learning) can 
provide greater flexibility and precision, but full autonomy 
in this area is risky. For spacecraft with sporadic or slow 
communications with the ground, some degree of 
autonomous learning may be a hard requirement. Self- 
modifying behavior ranges from tuning ot parameters on 
the basis of observed trends, as is currently performed by 
LENA, to more fundamental changes realized through 
machine learning. If at all possible, an incremental path 
through this space is desirable in order to manage the risks. 

Finally, the model can evolve towards generality across 
many instruments. Eventually we would like the model for 
LENA to be an instantiation of a generic machine- 
processable instrument model. Here too there are cost and 
performance tradeoffs. Adaptation of a generic model to a 
particular instrument is closely related to the issues of 
model representation and learning. 


Challenges 

There are potential uses of machine learning that go 
beyond the refinement of thresholds for LENA or other 
instruments. For example, empirical data could be used to 
refine LENA'S model for predicting when normal 
operations can be safely resumed. More generally, 
unsupervised learning could be used to infer significant 
states of the instrument (e.g., passing through the radiation 
belt) and the protective actions that are appropriate to them. 
This would be especially useful for instruments that, unlike 
LENA, must initiate protective measures before a 
dangerous phenomenon occurs (such as pointing directly to 
the sun) rather than in reactive response. In addition, as 
instruments age, they often degrade or develop undesirable 
states that may be identified by learning techniques. 

Issues that arise in considering such a role for machine 
learning include the required accuracy of the learned 
models, and the amount of data and time required to train 
the system to reach a suitable level of accuracy. For 
example, suppose LENA autonomously refined its model 
for predicting when nominal operating voltage can be 
restored. Could there be a scenario in which the system 
restored nominal voltage, discovered that high count rates 
still occur, dropped the voltage again, restored it again, and 
continued to thrash in this manner indefinitely? What 
learning mechanisms must be in place in order to prevent 
this from happening? 

A related issue concerns the delegation of authority to 
evolve a model. Would there be value in applying machine 
learning to recommend a refined model, but leaving the 
approval of the change to human authority on the ground? 
How would such recommendations be represented in order 
to be comprehensible (and the implications clear) to a 
human? 

Related to this question, in turn, is the allocation ot 
resources to perform a learning algorithm. Can linear 
statistical methods be used to advantage, or is a more 
complex inductive or connectionist learning method 
necessary? Should the computations be performed on the 
spacecraft or on the ground? Could the computations be 
time-sliced over a relatively long interval to take advantage 
of down-time in the instrument processor? 

These issues are among the challenges facing us in our 
attempt to realize a true model-based approach to 
autonomous instrument operations. The success we have 
experienced so far puts us in a very good position to make 
progress these issues. 
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